diff --git a/pkg/reconciler/common/testdata/test-replace-image.yaml b/pkg/reconciler/common/testdata/test-replace-image.yaml index 602f740a7a..432410fe7e 100644 --- a/pkg/reconciler/common/testdata/test-replace-image.yaml +++ b/pkg/reconciler/common/testdata/test-replace-image.yaml @@ -17,7 +17,8 @@ spec: name: controller-deployment args: [ "-bash-image", "busybox", - "-nop=nop" + "-nop=nop", + "-shell-image-win", "mcr.microsoft.com/powershell:nanoserver" ] - image: busybox name: sidecar diff --git a/pkg/reconciler/common/transformers.go b/pkg/reconciler/common/transformers.go index bf0d53b195..b8188ede85 100644 --- a/pkg/reconciler/common/transformers.go +++ b/pkg/reconciler/common/transformers.go @@ -321,16 +321,23 @@ func replaceContainerImages(containers []corev1.Container, images map[string]str containers[i].Image = overrideImageRegistry(registry, containers[i].Image) } - replaceContainersArgsImage(&container, images) + replaceContainersArgsImage(&container, images, registry) } } -func replaceContainersArgsImage(container *corev1.Container, images map[string]string) { +// replaceContainersArgsImage replaces image references passed as container +// args (e.g. "-workingdirinit-image", "gcr.io/..."). If no per-image env var +// matches a given "*-image*" flag (e.g. "-shell-image-win"), it falls back +// to rewriting just the registry domain, so TEKTON_REGISTRY_OVERRIDE alone +// also applies to arg-based images and not only to container.Image. +func replaceContainersArgsImage(container *corev1.Container, images map[string]string, registry string) { for a, arg := range container.Args { if argVal, hasArg := SplitsByEqual(arg); hasArg { argument := formKey(ArgPrefix, argVal[0]) if url, exist := images[argument]; exist { container.Args[a] = argVal[0] + "=" + url + } else if strings.Contains(argument, "_image") { + container.Args[a] = argVal[0] + "=" + overrideImageRegistry(registry, argVal[1]) } continue } @@ -338,6 +345,8 @@ func replaceContainersArgsImage(container *corev1.Container, images map[string]s argument := formKey(ArgPrefix, arg) if url, exist := images[argument]; exist { container.Args[a+1] = url + } else if strings.Contains(argument, "_image") { + container.Args[a+1] = overrideImageRegistry(registry, container.Args[a+1]) } } } diff --git a/pkg/reconciler/common/transformers_test.go b/pkg/reconciler/common/transformers_test.go index 8713d540e4..e75e1aad87 100644 --- a/pkg/reconciler/common/transformers_test.go +++ b/pkg/reconciler/common/transformers_test.go @@ -277,6 +277,27 @@ func TestDeploymentImagesRegistryOverrideFallback(t *testing.T) { assertDeployContainersHasImage(t, newManifest.Resources(), "sidecar", "custom-registry.io/custom-path/busybox") } +func TestDeploymentContainerArgsImagesRegistryOverrideFallback(t *testing.T) { + t.Setenv("TEKTON_REGISTRY_OVERRIDE", "custom-registry.io/custom-path") + // no per-image env var matches any arg in the manifest + images := map[string]string{ + "some_other_image": "foo.bar/unrelated", + } + testData := path.Join("testdata", "test-replace-image.yaml") + + manifest, err := mf.ManifestFrom(mf.Recursive(testData)) + assertNoError(t, err) + newManifest, err := manifest.Transform(DeploymentImages(images)) + assertNoError(t, err) + // "-bash-image" ends in "-image", so the registry override fallback applies. + assertDeployContainerArgsHasImage(t, newManifest.Resources(), "-bash-image", "custom-registry.io/custom-path/busybox") + // "-shell-image-win" contains "-image" but doesn't end with it (real example + // from the Tekton Pipeline controller manifest); the fallback must still apply. + assertDeployContainerArgsHasImage(t, newManifest.Resources(), "-shell-image-win", "custom-registry.io/custom-path/powershell:nanoserver") + // "-git" does not look like an image flag and must be left untouched. + assertDeployContainerArgsHasImage(t, newManifest.Resources(), "-git", "git") +} + func TestTaskImagesRegistryOverrideFallback(t *testing.T) { t.Setenv("TEKTON_REGISTRY_OVERRIDE", "custom-registry.io/custom-path") images := map[string]string{}